Security of continuous-variable quantum key distribution against general attacks 
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We prove the security of Gaussian continuous- variable quantum key distribution against arbitrary 
attacks in the finite-size regime. The novelty of our proof is to consider symmetries of quantum 
key distribution in phase space in order to show that, to good approximation, the Hilbert space of 
interest can be considered to be finite-dimensional, thereby allowing for the use of the postselection 
technique introduced by Christandl, Koenig and Renner (Phys. Rev. Lett. 102, 020504 (2009)). Our 
result greatly improves on previous work based on the de Finetti theorem which could not provide 
security for realistic, finite-size, implementations. 



Quantum key distribution (QKD), the art of gener- 
ating a secret key among distant parties in an untrusted 
environment, is certainly the most studied quantum cryp- 
tographic primitive. Since the seminal papers of Ben- 
nett and Brassard [l[ and Ekert 0| , considerable progress 
has been made in terms of security analysis Secu- 
rity against arbitrary attacks has been proven for several 
protocols, even in the realistic finite-size regime. This 
is quite remarkable because of the very large number 
of possible attacks against which security needs to be 
guaranteed. Security proofs generally circumvent this 
problem by using the natural permutation invariance of 
most QKD protocols which allows to restrict the analy- 
sis to the much smaller class of collective attacks, where 
the eavesdropper interacts independently and identically 
with every communication signal. In an entanglement- 
based description of QKD, this amounts to assume that 
the joint state pa™ s™ that the two legitimate parties, Al- 
ice and Bob, hold after the initial distribution of entan- 
glement, has an identical and independently distributed 
(i.i.d.) structure pA n B n = o~ab, where n is the number 
of quantum signals exchanged during the protocol. 

One usually achieves this reduction from general to 
collective (i.i.d.) attacks thanks to either de Finetti- 
type theorems [j] or the postselection technique [H . Un- 
fortunately, these tools cannot be directly applied to 
continuous-variable (CV) protocols because they require 
the dimension of the Hilbert space to be finite (and small 
compared to n). However, by prepending a suitable en- 
ergy test to the protocol, it is still possible to use a spe- 
cific variant of the de Finetti theorem and derive the 
security of CV protocols, but only for impractically large 
values of n Here, we wish to improve the analysis of 
Q to prove the security of continuous-variable QKD in 
the realistic finite-size scenario. 

The specificity of CV protocols is that the detection 
consists of (homodyne or heterodyne) measurements of 
the light-field quadratures (see Ref. Q for a review). 
From an experimental point of view, they present many 
advantages over discrete- variable protocols. Most impor- 
tantly, they can be implemented with standard telecom 
components and are compatible with Wavelength Divi- 



sion Multiplexing Q, which is an important advantage 
when integrating QKD into real-world telecommunica- 
tion networks. Moreover, quadrature measurements do 
not require any photon counters and higher repetition 
rates can be achieved. Distribution of secret keys over 
long distances (more than 80 km) is currently achiev- 
able [jj, making CV protocols competitive with respect 
to their discrete- variable counterparts. Their security 
analysis, however, is technically challenging due to the 
infinite-dimensional nature of the relevant Hilbert space. 

Among CV protocols, the so-called Gaussian ones are 
the most popular ones, primarily due to their experi- 
mental simplicity. In a prepare-and-measure scheme, one 
party, Alice, prepares coherent or squeezed states with a 
Gaussian modulation and sends them to a receiver, Bob, 
who applies a homodyne or heterodyne measurement. 
In the equivalent entanglement-based scheme, Alice pre- 
pares an entangled two-mode squeezed vacuum state (the 
continuous- variable equivalent of the Bell pair), keeping 
one mode and sending the other one to Bob through the 
quantum channel. Then both parties measure their re- 
spective mode with either a homodyne or heterodyne de- 
tection, obtaining two strings of correlated real-valued 
data. Finally, Alice and Bob extract a secret key through 
information reconciliation and privacy amplification. 

The security of Gaussian protocols in the aymptotic 
regime is rather well understood: de Finetti's theorem 
guarantees that collective attacks are optimal @ and 
Gaussian attacks are known to be optimal among col- 
lective ones fiol . [TlT | . On the other hand, their security 
in the much more relevant finite-size regime is less clear, 
due to the difficulty of the reduction from general attacks 
to the i.i.d. scenario. Currently, two results in this di- 
rection are known for CV protocols, either based on a de 
Finetti theorem as stated above or on an uncertainty re- 
lation. The de Finetti approach [f| is unsuitable in prac- 
tical scenarios because n, the required number of signals 
exchanged during the protocol, is too large. The second 
approach, using an entropic uncertainty inequality (l~2l |. 
works for more reasonable values of n but unfortunately 
does not converge towards the asymptotic key rate secure 
against collective attacks in the limit of infinitely many 
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signals. Consequently, the tolerated losses are quite low, 
corresponding to a few hundred meters only. 

In the remainder of this Letter, we first explain how 
to modify a protocol secure against collective attacks by 
the addition of an initial test in order to enforce a certain 
property of the entangled state, namely a low single-mode 
photon number. Then, we apply these ideas to the spe- 
cific case of a Gaussian protocol where Bob performs het- 
erodyne measurements and establish its security against 
arbitrary attacks. 

Main result. — In this paper, we give the first security 
proof of CV QKD against general attacks, which guaran- 
tees a secret key rate for realistic experimental regimes, 
in terms of losses and noise. As in @, Il2j , this is achieved 
by prepending an initial test to a protocol already proven 
secure against collective attacks. The purpose of the test 
is to verify that the quantum state shared by Alice and 
Bob is well-approximated by a state living in a reason- 
ably small dimensional Hilbert space. Then, one can use 
the postselection technique [f| which shows roughly that 
if a (permutation-invariant) protocol is e-secure against 
collective attacks, then it is e-secure against general at- 
tacks with e = e x poly(n). 

Our result improves that of Ref. Q for two reasons. 
First the postselection technique guarantees much better 
bounds than the approach based on a de Finetti the- 
orem when reducing general to collective attacks [l3| . 
Moreover, and this is in fact the main technical contri- 
bution of the present work, we exploit specific symme- 
tries of the CV QKD protocol in phase space instead of 
the usual and less powerful permutation symmetry. We 
therefore obtain a very tight bound on the effective di- 
mension of the quantum state. More precisely, the QKD 
protocol is invariant if Alice and Bob process their respec- 
tive modes with global conjugate passive linear transfor- 
mations of their n modes before performing their mea- 
surements. This "rotational-symmetry" in phase space 
is better suited to analyze CV protocols [20|, allowing 
to precisely bound the effective number of photons per 
mode from the results of random quadrature measure- 
ments. This is in stark contrast with Ref. Q where the 
test only exploited the permutation symmetry of the pro- 
tocol. 

QKD protocols and their security. — A QKD pro- 
tocol is a CP map from the infinite-dimensional Hilbert 
space (Ha 8> Tis)®", corresponding to the initially dis- 
tributed entanglement, to the set of pairs (Sa, Sb) of Z-bit 
strings (Alice and Bob's final keys, respectively) and C, 
a transcript of the classical communication. In order to 
assess the security of a given QKD protocol £ in a com- 
posable framework, one compares it with an ideal proto- 
col [3 • Such an ideal protocol T can be constructed (at 
least in principle) by concatenating the protocol with a 
map S taking (Sa, Sb,C) as input and outputting the 
triplet (S, S, C) where the string S is a perfect secret key 
(uniformly distributed and unknown to Eve) with the 
same length as Sa, that is T = S o £. Then, a protocol 
will be called e-secure if the advantage in distinguishing 



it from an ideal version is not larger than e. This ad- 
vantage is quantified by (one half of) the diamond norm 
defined by 

\\£-F\\«:= sup \\(£ - ^^idzipABE)^, (1) 

PABE 

where the supremum is taken over (H A ®H B )® {n+k) ®lC 
for any auxiliary system IC. 

Prepending a test. — Our main technical result is 
a reduction of the security against general attacks to 
that against collective attacks, for which security has 
already been proved in earlier work. Let us therefore 
suppose that our CV QKD protocol of interest, £q, is 
secure against collective attacks. We will slightly mod- 
ify it by prepending an initial test T ■ More precisely, T 
is a CP map taking a state in a slightly larger Hilbert 
space, (Ha ® Hb)®^^, measuring k randomly cho- 
sen modes (identical for Alice and Bob) and comparing 
the measurement outcome to a value fixed in advance. 
The test succeeds if this norm is small, meaning that the 
global state is compatible with a state containing only 
a low number of photons per mode, that is a state well- 
described in a low dimensional Hilbert space, which leads 
to better bounds when using the post-selection technique. 
Depending on the outcome, either the whole protocol 
aborts, or one applies £q on the n remaining modes. A 
more precise description is provided as part of the "het- 
erodyne protocol" below. 

For our purpose, it is crucial that the test is feasible in 
practice. This is the case here since it only involves k ad- 
ditional homodyne (or heterodyne) measurements com- 
pared to the original scheme £q, with k much smaller than 
n, as well as applying some classical post processing to 
Alice and Bob's data. 

In order to establish that the protocol £ := £q o T is 
e-secure against arbitrary attacks, one needs to bound 
\\£ — J-\\o- The postselection theorem [f| allows one to 
bound the diamond norm between such maps by sim- 
ply considering i.i.d. states (i.e. the equivalent of col- 
lective attacks), but only when the maps act on fi- 
nite dimensional spaces. We address this issue by in- 
troducing another CP map V which projects a state 
in (Ha <8> Hb)® 11 onto a low-dimensional Hilbert space 
(Ha^Hb)® 71 where Ha := SpanflO), • ■ ■ , \d A - 1)) 
and Hb '■= Span(|0), |1), • • • , \<1b — 1)) are respectively 
a cLa and a rig-dimensional subspace of the Fock spaces 
Ha and Hb- We define (virtual) protocols £ := £qoVoT 
and JF := S o £ . The security of the protocol £ is then a 
consequence of the following derivation: 

||£-^||o < \\£ -t\\» + \\£-£\\« + \\F-Ho 

< ||£-.F|| <> + ||£o°(id-P)oT||o 
+ ||Joo(id-7>)oT||o 

< ||£-J-|| + 2||(id-P)oT||o, (2) 

where we used the triangle inequality and the fact that 
the CP maps £q and J-q cannot increase the diamond 



3 



norm. The first term can be bounded thanks to the posts- 
election theorem because £ and T are finite dimensional, 
and it can be made arbitrary small at the price of re- 
ducing slightly the key rate. The second term can be 
bounded thanks to the following theorem for which we 
give a proof sketch for the "heterodyne protocol" below 
(and a full proof in Appendix |A"|) . 

Theorem 1. (Informal.) For any rotationally-invariant 
state pabe € (R A ®H B )® (n+k) ® K, 

|| (id n ®n - V) o T® \&k{pabe)\\i < e, (3) 

where e is a function of k, n, the dimensions cLa and ds 
for the projection V and the value of the threshold in the 
test T ■ 

Description for the protocol with heterodyne 
detection. — Let us now consider a specific example of 
a QKD protocol £q. For the sake of clarity, we choose 
(arguably) the simplest one [l5| . In the prepare-and- 
measure version of the protocol, Alice prepares n coher- 
ent states which are modulated with a Gaussian distri- 
bution, and sent through the quantum channel. In the 
equivalent entangled version of the protocol, for which 
we prove security, Alice prepares n two-mode squeezed 
vacuum states, measures one mode of each state with a 
heterodyne detection and sends the other one through the 
quantum channel. Bob then performs a heterodyne mea- 
surement of the states he receives. This means that he 
measures both quadratures q and p for each mode. This 
is achieved by sending the modes on a balanced beam- 
splitter and measuring the q quadrature for one output 
mode and the p quadrature for the other one. At the 
end of this process, Alice and Bob have access to two 
correlated vectors in R 2rl , xa for Alice and xb for Bob. 
Then, they perform the reconciliation procedure (l6| in 
order to extract a common string, and finally privacy 
amplification pj| to distill their final secret keys, Sa and 
5b, respectively. 

This protocol is invariant under the action of conju- 
gate passive symplectic operations (beamsplitters and 
phase shifts) because these correspond to some orthog- 
onal transformation R G 0(2n) of the quadratures in 
phase space. Specifically, if such an operation is applied, 
then Alice and Bob's vectors become Rxa and R t xb (see 
Appendix [E] for details) , meaning that the effect of the 
beamsplitters and phase shifts can be undone by simply 
applying the inverse rotation on the classical data. 

We assume in the following that the protocol £q is se- 
cure against collective attacks, in the sense that for any 
pure state pabe & 'Ra®'Hb®'Re where *He — R-aQ'Hb, 
the quantity || (£ — Tq) <g> id/c (pabe) II i can ^ e ma de ex- 
ponentially small in n, say 2 at the price of reducing 

the secret key rate by an arbitrary small fraction i5 com- 
pared to the asymptotic optimal rate, for some constant 
c > 0. We note that despite being proven secure against 
collective attacks in the asymptotic limit [Tol . [ill . [l8| , the 
security of £ o for finite size attacks is not yet completely 



understood in the sense that the precise values of c and 
(5 are not currently known: this is due to the difficulty of 
estimating a covariance matrix in the finite-size regime 
(see [H). 

As we mentioned above, we will prove the security of 
a slightly modified protocol, noted £ which starts with 
n + k modes (instead of n in the case of k of which 
being used to conduct a test T. If the test passes, corre- 
sponding roughly to a scenario where the state does not 
contain too many photons, then Alice and Bob proceed 
with the protocol £q, otherwise they abort. The test T 
is in fact only applied to Bob's classical data. Indeed, 
we assume here that Alice prepares her state in a trusted 
environment meaning that her reduced state is an (n+k)- 
modal thermal state. Note that one could easily remove 
this assumption and also apply T to Alice's state. 

The test consists in first choosing a random rotation R 
in R 2 ( n + fe ) (with the appropriate measure) and applying 
it to the 2(n + fc)-dimensional vector corresponding to 
Bob's measurement outcomes (as well as to Alice's vec- 
tor). Let us denote by q\,p\, 92, P2, ■ ■ ■ ,<Zfe,Pfc the first 2k 
coordinates of Bob's rotated vector and define the vari- 
able Yfe := Y^i=i(li +Pi )■ The coordinates correspond to 
heterodyne measurements of k modes of p n B +k after being 
processed through an appropriate network of beamsplit- 
ters and phase-shifts (see Appendix |E| . The test T is 
characterized by 2 parameters: a positive number Ytest 
and k. The test passes if Yk < Y tcst and fails other- 
wise. More precisely, because the test commutes with 
the measurement, it can equivalently be seen as a map 
from (H A ® U B )® {nJrk) to (Ha ® H B )® n (phis an addi- 
tional bit encoding whether the test passed or not) that 
returns the n remaining modes when it passes and an 
"abort" state when it fails. 

It is also useful to describe the CP map V charac- 
terized by three numbers, n, and the local dimensions 
dA and dB- It corresponds to the binary outcome mea- 
surement in (Ha ® 'R B )® n described by the POVM 
{Pf " ® Pf 1 - Pf n g> Pf "} where P A and P B are 
the single- mode projectors on R.a and R.b, respectively, 
defined as P A/B - |0)(0| + |1)(1| + - • -+1^-1X^/5-11 • 

In order to establish Theorem [TJ we will bound the 
probability pbad of the following bad event: "the state 
passes the test and the projection onto P® n (g> Pj 1 ™ fails" 
for some initial state p\ B £ (H-a ® R-b)®" ■ Let us note 
Pab the unnormalized state after the test when it passed; 
the probability of passing the test is simply ptcst = ^ t Pab 
and pbad = tr [(1 - V)oT {pa^)] ■ One can bound p ba d 
in the following way: 

p had = tr (id AB - Pf 1 ® Pf") p n AB 

< tr [(id* - Pf n ) Pa] + tr [(id fl - PT) PI] 

< tr [(id* - PT) Pi] + tr [(id fl - PT) Pfl](4) 

where we used the union bound and the fact that Al- 
ice does apply the test. The first term is easy to com- 
pute because the state of Alice, a multimode thermal 
state, is well known: p\ = pj|™ rmal with pthormai = 
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J2T=o (i+x)k+i f° r a state with A photons per mode. 
The value of A is a parameter of the protocol and should 
be optimized given the expected characteristics of the 
quantum channel. The union bound gives 

1 - tr (Pf >1) < n(l - tr (P A p tiLeIma ,i)) = n ( J^A ) ' 

In particular, choosing <1a = \og(\+if\) f° r the dimension 
of Alice's Hilbert space leads to 1 - tr (Pf n p n A ) < e A . 

Bounding the second term in Eq. (j4]) is much trick- 
ier because one cannot assume that Bob's state p B is 
Gaussian or that it even has an i.i.d. structure. This 
is because it corresponds to the output of the unknown 
quantum channel controlled by Eve. Here, we will make 
use of the specific symmetries of the QKD protocol in 
phase space in order to simplify greatly the problem. In 
general, most protocols are invariant under permutations 
of the subsystems of Alice and Bob. This means that 
the state p AB (and therefore also p B ) can be assumed 
to display this invariance. However, CVQKD protocols 
such as the one considered here respect a much stronger 
symmetry: they are invariant when Alice and Bob ap- 
ply to their respective (n + k) modes conjugate passive 
linear transformations, implemented by any network of 
beamsplitters and phase shifts [HI, [2(| (see Appendix [E] 
for details). Here, it is crucial that the test T respects 
the symmetry, and this can be enforced at the level of 
classical data by the choice of the random subspace T of 
■R,2(n+fc) (as explained before). 

Thanks to this symmetry, one can assume that the 
state p B +k of Bob (before applying the test T) is 
rotationally invariant, that is, left invariant under the 
action of any network of passive linear operations on 
their n + k modes. Such states were already studied in 
Ref. [2l[ where a de Finetti theorem was established: if 
sufficiently many modes of p B +k are traced out, then the 
remaining state is close to a mixture of thermal states. 
Intuitively, one then expects that the second term of Eq. 
|4]behaves like the first one, and this is what we prove rig- 
orously. Before we explain how to bound tr (P B n p B ) > we 
recall two useful properties of states, such as p B +k , which 
are rotationally invariant (2l|. First, these states are 
mixtures of generalized (n + /c)-mode Fock states a p +k := 

jy^i+fc+p-l^ J2 pi+ ... +Pm=p \PX,P2, ■ ■ ■ ,PmYpx,P2, ■■■ ,Pm\, 

where \pi,--- ,p m ) is the product of Fock states with 
Pi photons in the first mode, p2 photons in the second 
mode, etc, and the sum is taken over all states with 
a total number of p photons in n + k modes. This 
means that there exist Ao > 0,Ai > 0, ■ • • such that 
/ 9 B +fe = Y^p^Lo \ a p +k ■ The second useful property is 
that the Wigner function W(qi,pi,--- ,q n+k ,p n+k ) of 
p B +k is isotropic, that is only depending on the norm 
of the vector (qx,Px,--- iQn+kiPn+k)- The same also 
holds for the Q-function of the state, that is the prob- 



ability distribution of the outcomes of the heterodyne 
measurements . 

Let us introduce another random variable Z„ := 
1/(2^) Y^i=i 1k+i + Pk+i> corresponding to the norm of 
Bob's heterodyne measurements for the n modes of p B +k 
not measured during the test T. We show in the ap- 
pendix that the probability et es t of passing the test but 
Z n being much larger than Ytest is exponentially small 
in k when the value of Yt es t is chosen slightly larger 
the expected variance of Bob's measurement results (see 
Lemma IA.2P . In turn, this implies that the total num- 
ber of photons in the state p B is bounded by 0(nY tes t) 
(see Lemma |A.3[) . Finally, we show that the projection 

over the space H% n succeeds with high probability if 
d B = dimHs = O(log^) (see Lemma ED- This fi- 
nally provides a bound on ||(1 — V) o 7~||o and proves 
Theorem [TJ 

We now put things together and establish that pro- 
tocol £ is secure against general attacks. First, choos- 
ing dA and d B on the order of 0(log(n/e t ost)), one ob- 
tains ||(1 — V) o 7"||<> < etest- Second, assuming that 
the original protocol £o is secure against collective at- 
tacks, the diamond norm \\£ — .F||o can be bounded 
by 2- c<52 " +0 ( lo s 2 ("/ e *-*)) using the postselection tech- 
nique where the dimension of the relevant Hilbert space 
V-a^T-Lb is dAds = O (log 2 (n/e tC st)) (see [f| for details). 
This shows that protocol £ is e-secure against general at- 
tacks with 

£ = 2 -c5 2 n +0(log 2 („/ etoat )) + 2ete ^ £gj 

Conclusion. — We have proved that Gaussian 
continuous-variable QKD protocols, using a Gaussian 
distribution of coherent states and homodyne or het- 
erodyne measurements, are secure against arbitrary 
attacks. Our proof exploits the specific symmetries 
in phase-space of Gaussian QKD protocols and uses 
a simple test to ensure that the global state shared 
between Alice and Bob is well described by assigning 
a low dimensional Hilbert space to each mode. This 
allows one to use the postselection technique introduced 
in Ref. [E[ for discrete- variable protocols. Our result 
greatly improves on a previous one using a de Finetti 
theorem which could not be applied to prove the security 
of protocols in realistic experimental implementations. 
Finally, our analysis indicates that in order to prove 
the security of any QKD protocol, one should exploit 
all the available symmetries of the protocol, beyond the 
traditional permutation. 
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Appendix 

In this appendix, we detail the various technical results used in the main text. In Appendix [Al we explicitly 
state our main theorem for the continuous- variable protocol where Bob uses heterodyne detection. The proof of the 
main theorem uses three lemmas which are established in Appendices [B] [C] and [D] In Appendix [Ej we detail why 
the protocol is invariant under the action of a network of beamsplitters and phase shifts, justifying the symmetry 
assumption made on Bob's quantum state. 

The rest of the appendix is devoted to protocols where Bob performs a homodyne detection instead of a heterodyne 
one. We state our main theorem in that case in Appendix |FJ We prove in Appendix [G] that Bob's state can again 
be considered invariant under the action of beamsplitters and phase shifts. Our main theorem uses two of the same 
lemmas as in the heterodyne case and a variant of the third one which is established in Appendix [HJ 



Appendix A: Main theorem for the heterodyne protocol 

In order to make use of the relevant symmetries in phase space, the test itself should be invariant under the 
application of an arbitrary network of beamsplitters and phase-shifts on Bob's (n + k) modes before he proceeds with 
his measurement. This can be enforced by actively symmetrizing the state, which can be done at the level of classical 
data (see Ref. [22j for a discussion on this active symmetrization) . 

Bob randomly chooses a random unitary U from the Haar measure on the unitary group U(n + k). Then, he 
symmetrizes his state thanks to the network of beamsplitters and phase shifts applying the transformation U on the 
annihilation (61, • • ■ , 6 n +fe) an d creation operators (b\, ■ ■ ■ , b^ n+k ) of his (n + k) modes through 

n+k n+k 

<>■ 'X',A and b\ (Al) 

3=1 3=1 

and finally measures his (n + k) modes with a heterodyne detection. The state p®( k + n ) held by Bob after this 
symmetrization is called rotationally invariant. 

Crucially, Bob can also first measure his state with a heterodyne detection and only then implement U by applying 
the symplectic transformation S given by 

(Re(U) -lm(U)\ , . . 

6 -~ \Im(U) Re(U) J [AZ) 

to his classical vector of measurements. This is true because the symmetrization in phase-space commutes with the 
heterodyne measurement (see Appendix IE1 for details). 

We denote (qi,pi, ■ ■ ■ , q n +k,Pn+k) the classical vector Bob obtains after this procedure. Thanks to the symmetriza- 
tion, without loss of generality, the test T can be applied to the first k modes, that is to the data (qi,pi, ■ • • , qk,Pk)- 

We now state our main theorem for the protocol with heterodyne detection. 

Theorem A. 1 (Heterodyne protocol) . Let e, Itcst > be fixed parameters. Let Yf. = j- ^,=1 (<zf + Pi ) be the average 
of Bob's (squared) heterodyne measurement outcomes on the first k modes of his state after symmetrization, and let 
p n be the state of the n remaining modes. Let ds := iogfi+"/d Q ) w here do := g (| ) Yt ost (and g is defined in Eq. \Afy) 
and let T-Lb = Span{|0), • • • , \ds — 1)} be the finite dimensional Hilbert space spanned by states with less than ds 
photons. Then the probability that Yk < Y tcs t and that the projection of p n onto H B " fails is less than e. 

In order to prove Theorem I A. 1| we need to introduce some operators acting on some subspace of T-L^ n+k \ To keep 
notation simple, we use the subscript k (resp. n) when the operator acts on (resp. Ti.^ 1 ) corresponding to the 
first k modes (resp. the last n modes) of the symmetrized state. Let us define the POVM elements T^, T n , U n and 
V n on U® n as follows: 

• Tk acting on W® k corresponding to a failed test, meaning that the value of the observable Yk is larger than T tegt : 

Tk := —r / • • • \ockYfiCk\dat ■ ■ -da k , (A3) 
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T„ is the projector onto products of coherent states \cti) ■ ■ ■ \a n ) € T-L% n such that Yl7=i \ a i\ 2 — n do'- 



1 



7T" 



|ai)(ai| • • ■ |a n )(a„|dai • • -da„, 



'H"=l \ai\ 2 >nd 

• U„ is the projector onto the subspace of %® n spanned by states with more than nd photons 



(A4) 



U ■= \ IT" 

m— nd.Q + 1 



(A5) 



where we introduced the projector IIJ^ on the subspace spanned by n-mode states containing m photons: 

n m = X! |m! • • •m„)(m 1 • • -m n |. (A6) 

mi-| \-m n —m 

V n is the projector onto the subspace of H® n such that at least one mode contains at least ds photons: 



(A7) 



where Pg 



+ --- + |d s -iXrfi?-i|. 



With these notations, Theorem lA.il simply gives an upper bound on pbad : = tr [V n (l — Tk)p n+k ] for any rotationally 

invariant state p n+k g "H® . The quantity pbad is the probability that the state passes the test and that the 

projection on the finite-dimensional subspace 'Hg™ fails. 

The proof of the theorem uses the following variants of three technical lemmas proven in Sections [B] [C] and [D] of 
this appendix. We first state Lemma IA.2I which is a corollary of a result proven in Section [B] 

Lemma A. 2. Let X = (X±, ■ ■ ■ , Xk+ n ) be a vector of (C n+fc . Let U be a random unitary transformation of U(n + k) 
drawn from the Haar measure, and define Y = [/X. Then 



Pr 



£ElW>*(^£l y *l s 



< 5 



(A8) 



whe 



9(5) 



1 + 2 



log(l/<?) , 21og(2/3) 



rlog 



(A9) 



By construction, the vector Y = (Yi,--- ,Y n+ k) is uniformly distributed on the complex sphere in (C n + fc with 
radius ||V||, and consequently, the real vector (Re(Yi), Im(Yi), • • • , Re(Y n+ k), lm(Yt n +k)) is uniformly distributed on 
the corresponding real sphere in ]R 2 (" +fc ). Lemma [A. 21 is then a special case of Lemma [B. II 

The following lemma is proved in Section [Cj 



Lemma A. 3. 



U n < 2T„. 



(A10) 



Our final lemma quantifies the maximum number of photons in a single mode for a rotationally invariant state with 
nd photons in n modes, except with a small probability: 

Lemma A. 4. Let mi,-- - , m n be the random variables corresponding to photon counting measurements of the n 
modes of the state a" d which is a uniform mixture of states with nd photons in n modes. Then, the following bound 
holds: 



Pr 



Jog(5) 
max mi > - — t~ /, ,, 
i=l-n ~ log(l + l/d) 



< e. 



(All) 
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Proof of Theorem \A.l[ We fix da := g (f ) Ytest an d cLb '■= logfi+i/do) ' From Lemma [A.2( we know that 

trT„(l fc -T k )p n+k < | (A12) 

for any rotationally invariant state From Lemma rA.3[ we obtain 

trC/„(l fc -T fc )p" +fc < | (A13) 



and Lemma [A.4I shows that 



tr(l-[/„)14p" +fc <! (AU) 



for any rotationally invariant state p n+k . 

Using that V n < V n (l — U n ) + U n , one finally has: 

Pbad,Bob := tr [(V n o T)p H+k ] (A15) 

= t r [V n (l k -T k )p n+k ] (A16) 

< tr [(1 - U n )V n (l k - T k )p n+k ] + [U n (l k - T k )p n+k ] (A17) 

< tr [(1 - U n )V nP n+k ] + 2trT n (l fc - T k )p n+k (A18) 

< | + 2x J ( A19 ) 

< e. (A20) 

□ 

Appendix B: Concentration of measure on the sphere 

In this section, we establish the following result which implies Lemma [A. 21 
Lemma B.l. // the vector X = (Xi, ■ ■ ■ ,X k+n ) is uniformly distributed on the unit sphere o/R™ +fc , then 

k 



Pr 

where 



n 

i=l i=l 



< $ (Bl) 



1 + oJ log( - 2/S) J- 2lo ^ 2 / & ) 



9(5) = , (B2) 

l-2Jilog(|) 



We do not prove Lemma IB . 1 1 directly because manipulating normalized vectors on the sphere is not very convenient. 
We use instead the natural invariance of the problem and first show that it is sufficient to prove the lemma for 
independent normal variables instead of vectors on the unit sphere. This is the case because a uniformly chosen 
vector on the sphere can be obtained by drawing n independent normal variables and normalizing the corresponding 
vector. 

Let X±,--- , X n be such independent normal random variables: Xi ~ A/"(0,1), and let us define the following 
quantities: 

k 1 n 

Yk = kJ2 X ? and Z « = -E X "+- (B3) 

i=l i=l 

Note that the normalized random vector X = . ^ (X\, ■ ■ ■ ,X n+k ) is uniformly distributed on the unit sphere 
of R ri+fc . In particular, it is sufficient to prove that 

Pr [Z n > g(S)Y k ] < 6 (B4) 
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in order to establish the lemma. 

Let us proceed with the proof of Eq. IB4I We first notice that for any A > 0, 

Pr [Z n > g(S)Y k ] < Pr [Y k < A] + Pr [Z n > g{5)A] 



(B5) 



We can now bound this two probabilities using the fact that Y k and Z n are independent random variables, with 
a x 2 (^) an< i a X 2 { n ) distribution, respectively. To this end, we use two bounds on \ 2 distributions established by 
Laurent and Massart 1231: 



Pr 



Y h < 1 - 2 



< exp(— x) and Pr 





2x~ 


Z n > 1 + 24/-- 


— 


V 71 


n 



< exp(— x). 



Choosing x = log(2/(5) in both cases gives 
Pr Y h < 1 - 2 



log(2/a) 



< - and Pr 
~ 2 



Z n > 1 + 2 



log(2/<5) , 2bg(2/<5) 



<5 

< -. 
~ 2 



Taking A := 1 — 2-t M log (-) concludes the proof of Lemma [B. II 



(B6) 



(B7) 



Appendix C: Proof of Lemma I A. 3l 



In this section, we prove Lemma lA.31 which we recall here. 
Lemma IA.3i Let T n and U n be defined as 

1 



and 



T n :=— I ' ' ' \a n }(a n \dai ■ ■ -da n , 

71 Jj27=l \^\ 2 >nd 



U n ■= ^ n ™ Witfl n ™ = I 7 " 1 " ' TO «)( m l ' ' ' TO "I 



m— ndo + 1 

Then, the following inequality holds: 



mi -\ \-m n —rn 



U n < 2T n . 



(CI) 



(C2) 



(C3) 



1. Some preliminaries 

The following integrals will be useful. For a > 0, let us define: 



and 



J n {k,a) 



-J/l-2/2 Vr 



dyi • • • dy n 



y± e -yi-y2—y ndyi ... dlJn 



These integrals can be computed explicitly. 
Lemma C.l. 



(C4) 



(C5) 



/c=0 

r(fe + l,a) 



J n (k,a) 



r(fc + i,o) 



a E 

m— fc+l 



(C6) 
(C7) 



Proof. The first equality is proved by induction. It is clear that Ii(a) = e °. Then: 



1 - I n+1 (a) = / e -yi-« a »-»-+i dyi . . . dyn+1 



dy„+ie - I n (a - y n +i)) 



J dy n+ie ~ y ^ 1 1 - e - a +y^ 



n—i , si 



fc! 

fe=0 



fc! 

fc=0 



n-l 



fc+l 



fe =o ( fc + 1 ) ! 



n \ a 



fc! 

fc=0 



J„(fc,a) = l- / ^e-^-^-^dj/i-.-d^ 
Jyi>o,J21 =1 y t <a fc - 



fc! 



y;>0,X]"=2 yi<a-yi 



dj/i^e- yi (l-^-i(«-yi)) 
1-f dj/1 |e-- (i-e-^g^ - ^ 



m=0 



r(fc + i,a) [ a yHa-yT 

r(fc + l,0) +e fc!m! ' y 

where r(s,x) = J^ i s_1 e _t dt is the incomplete gamma function Using the fact that 

k\m\a k+m+1 



x k (a-x) m dx 



(k + m+ 1)!' 



one obtains 



J w(M ) = g*±^ + e--g ^ 
™ v ' ; rYfc -t- 1 ^ 



r(fc + i,o) z_, o (fc + m + i) 

r(fc + l,0) ^ ml 
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2. Proof of Lemma [A31 



Integrating over the n phases gives: 

h \ ,k 7 - 



hi 



Te Xi -^jdx l \k 1 ---k n )(k 1 ---k n \ 

>0,£? =1 Xi>nd i=1 k i- 



(C25) 



Because of its rotation invariance in phase-space, the operator T n can be written as a mixture of TF k l . Let us note 
<7fc > the corresponding coefficients: T n — J2T=o l^k- Considering the term (k, 0, • • ■ , 0|T„|fc, 0, ■ • • ,0), it is easy 
to see that q k = J n (k,ndo). 



The proof is then immediate by noticing that the sequence 



r(fc+l,a) _ 

r(fc+i,o) qk 



a J2 k „t=k+i S ( where we used the 



m 

poo 



result of Lemma [C.l|) is positive and increasing with k for all a > 0. Here, T(s,x) := f^°t s x e *dt refers to the 
incomplete Gamma function. This means that for k > ndo + 1, 



k+n 



qk > r("^o + i.^o) , e -q y £1 . - , 



r(nc?o + lj ^do) i 



r(ndo + l,0) 



m— k-\- 



i m! ~ T{nd + 1,0) ~ 2' 



where we used that rja+i'oj ^ s l° wer bounded by 1/2 for all x > 0. This allows us to conclude that 

U n < 2T n . 



(C26) 



(C27) 



Appendix D: Proof of Lemma IA.4I 

The set of vectors X = (Xi, ■ ■ ■ ,X n ) such that X)"=i = ^ and -^i — m contains a fc_ m : = ( n+ feZm _1 ) elements. 
Let us note p/c(m, n) the probability that the maximum of Xj is greater than to if one measures the photon number 
for the state er£: 



Pk(m, n) = Pr 



nax X; > to s.t. > Xi = k 
=i— n ^— ' 



i=l 



The union bound gives: 



p k (m,n) < Pr 



Xi > m s.t. y^Xj = fc 



Pr 



X„ > TO S.t. Xi = fc 



a5J_ TO (n + fc — m— l)!fc! n(n + k) (n + k — m)\k\ 
< n = fl- 



irt + fc — l)!(fc — to)! n + k — m (n + k)\(k — to)! 
Let x > 0, then Stirling approximation formula reads (here log is the natural logarithm): 



(Dl) 

(D2) 
(D3) 



1 



nx logn, + na;(log x— 1) + — logn+ — log 2; + log \/27r < log(nx)! < nx \ogn + nx(logx— 1) + — logn+ — logx+l. (D4) 



Let us introduce the variables d and d such that k = dn and to = Sn. Then 
(n + k — m)\k\ 



log 



(n + k)\(k - to)! 



where 



This gives 



log(n(d + 1 - 5))\ + log(nd)! - log(n(d + 1))! - log(n(d - 5))\ 
< n m - 9 (d - 6)} + \ log + 2 - log 2. 



5(2;) = (a; + 1) log(a; + 1) — x\ogx. 
logp fc (TO, n) < -n {g(d) - g(d - <5)} + log n + ^ log ^ + 2 - log 2tt 



(D5) 
(D6) 

(D7) 

(D8) 
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The function g is concave which implies that g(d) — g(d — S)> 8g'(d) = <51og(l + 1/d), and therefore 

- logpkim, n) > 71(5108(1 + 1/d) - logn + i log ^ + ^_ + ^ ~ ~ ~ 2 + lo S 27r ( D9 ) 

> n<51og(l + l/d)-logn-2 + log27T (D10) 

> nS log(l + 1/d) -logn -log 2 (Dll) 

(D12) 

Choosing m = gi ves Pk(m, n) < e and proves Lemma I A. 41 



Appendix E: Symmetry of the state for heterodyne detection 



In this section, we show that the symplectic transformation applied in phase-space commutes with the heterodyne 
detection. The compact subgroup of the symplectic group Sp(2iV, 1R) consisting of phase shifts and beamsplitters is 
usually noted K(n) in the literature and is isomorphic to the unitary group U(N) (see for instance Ref. [24]). We note 

a := (ai, ■ • • , djv) and a) := (a{, ■ ■ ■ , ajy) the vectors of annihilation and creation operators of the N modes considered. 
Then, in the Heisenberg picture, under a symplectic transformation, the o's and a^'s transform independently as: 

a^-Ua, and $ -> U*a\ (El) 

where U is a unitary matrix. 

Moreover, defining V = Ke(U) and W = — Im(U) the real and imaginary parts of U such that U = V — iW, the 
displacement vector (x,p) T := (xi, ■ ■ ■ ,xn,Pi, ■ ■ ■ ,Pn) T is transformed as 

In the quantum key distribution protocol, both Alice and Bob perform a heterodyne measurement of their respective 
n + k modes. The probability distribution of their outcomes is given by the Q-function of the state <G (Ha <8> 

H B ^®{n+k) : Q p (xa,Pa, xbtPb)- From the description given above of the subgroup K(n), it appears that the Q- 
function associated with the "rotated" state p' := (Ua <£> Mb)Pajb (^a ®U%)^ (where U is the representation of the 
symplectic transformation corresponding to the unitary U) is simply: 

Q p ,(x' A J A ,x' B J B ) = Q p (Vx A - Wp A , Wx A + Vp A , Vx B + Wp B , ~Wx B + Vp B ). (E3) 

This local (and classical) transformation of the coordinates can be applied by Alice and Bob. In other words, 
the quantum transformation corresponding to the networks of beamsplitters and phase-shifts commutes with the 
heterodyne measurement. 

Moreover, if one makes sure that the test (i.e., the choice of the random 2fc-dimensional subspace of ]R 2 ("+ fc )) 
respects the symmetry above, then the post processing of the QKD protocol commutes with the map Ua ® U* B , 
meaning that the state p n AB can be considered invariant under such maps. In particular, the state held by Bob, 
p B +k '■= tiAP^AB ^ S invariant under any U consisting in beamsplitters and phase shifts. 
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Appendix F: Main theorem for the homodyne protocol 



We now consider a protocol where Alice sends coherent states with a Gaussian modulation and Bob performs 
homodyne detection with a random quadrature chosen uniformly in [0, 2n] for each of his n + k modes. 

In the following, we note A 1; ■ ■ • , X n+ k the random variables corresponding to the n + k quadrature measurement 
outcomes for Bob. We assume that for each mode, Bob chooses a random direction 9 £ [0, 7r/2] in phase space. Then, 
he chooses to measure the quadrature either along 9 (which we call a q measurement) or along 9 + tt/2 (this is the p 
measurement). We will show in Section [G] that Bob's state can be assumed to rotationally invariant. 

Our main result is summarized by the following theorem. 

Theorem F.l. Let e, Itcst > be fixed parameters. LetY^ = i^i-^j be the average of Bob's (squared) homodyne 
measurement outcomes on the first k modes of his symmetrized state, and let p n be the state of his n remaining modes. 
Let do := 2g Y^. We choose n large enough so that e~^ n < j§ with (5 := c^d^ — l ° s 2 d ° and cq := (1 — l/\/2) 2 . Let 

ds = \ogfi+i fd ) ■ Let He = Span{|0), ■ ■ • , \ds — 1)} be the finite dimensional Hilbert space spanned by states with 

less than ds photons. Then the probability that Y^ < Itest an d that the projection of p n onto H^™ fails is less than e. 

The main novelty compared to the heterodyne protocol is the introduction of the operator W n , corresponding to 
the projection on the event [Z n > do/2], where Z n = i Yli=i Let us define the random variable Sj £ {Qi,Pi} 

corresponding to a quadrature measurement for the mode i, either q or p. Then, we can define a string s £ {q,p} n as 
being the n quadrature measurement outcomes when measuring the state p n . With these notations, 

W n = ^ E P Z ^ d ° /2 - (Fl) 
sG{aJ,p}™ 

We prove the following result in Section [H] 
Lemma F.2. 

T n < 2W n + e- pn t n (F2) 

where (3 = c d - and c = (1 - 1/V2) 2 . 

The proof of Theorem IF. II then follows exactly the same lines at that of Theorem IA.ll 

Appendix G: Symmetry of Bob's state for the protocol with homodyne detection 

Let p n+k = J2iJ a iJ ■ ■ ■ , i n +k)(ji, J2, ■ ■ ■ ,j n +k\ be Bob n + fc-mode state. 
The measurement protocol is the following: 

• for each mode j, Bob draws 9j uniformly in [0,27r] and measures the quadrature along cosflj-Ow + sin 9jPj. He 
obtains a measurement outcome Xj. It is actually sufficient to pick 9 from the set {0, 2ttj^, 2n-j^, • • • , 2n d ^ 1 }. 

• Bob then randomly chooses an orthogonal transformation R in ]R n+fc and applies it to his vector x — 
(xi, ■ ■ ■ , X n+ k). 

• finally, Bob informs Alice of his choices of 9j and R. 

Crucially, the transformation R can be equivalently obtained by applying a network of beamsplitters on the n + k 
modes. 

Because of the random choice of the measured quadratures, the state p n+k can be considered invariant under the 
application of U(9j) = e l9ja ^ aj . This means that 

p n+k oc 



oc 
oc 



\{U(9 j )\p\J{U{-9 j )\d9 (Gl) 

JZajMuh,--- ,i n+ k){h,h,--- ,jn+k\ [ e ^-h)... e ie,{i n+k -j n+k )^ (G2) 

iee[o,27r]"+ fc 

hi 

E a i,?l* 1 ' * 2 ' " ' >*n+fc)(«l,«2, ' ' ' i*n+fe|- (G3) 
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Because of the random rotation of the measurement results, the state can also be considered invariant under 
the action of any network of beamsplitters. In particular, it should be invariant when swapping any two modes 
and when applying infinitesimal beamsplitters. The first condition shows that the coefficient := ajj is invariant 

when permuting the coordinates of the vector i. The invariance under infinitesimal beamsplitters guarantees that 

a i\MM,--- ,in+k = ^1+1,12— 1,<3," - .«»+* = a «H Mn+fc,o.--- .o- In particular, the coefficient only depends on the total 

number of photons i in the n modes. 

Finally, the state p n+k can be assumed to be a mixture of the states of defined as: 



n+k _ 
"i ~ 'jn+k 



j- I*!)"- ,in+k)(h,--- ,in+k\- (G4) 



Appendix H: Proof of Lemma IF.2I 
1. Preliminaries 



Let us define F(a) as 



-.i|2 



n J\\Z\\ 2 >nd 



The spherical symmetry of the function guarantees that F(a) only depends on the norm of a. Let us note a = \\a\\. In 
the following, it is sometimes useful to think of the vector a as a = (a, 0, • • • , 0). The following bound will be useful 
in the proof of Lemma IF. 21 



Lemma H.l. For any do > 0, 



2 



Proof. Let us first compute the following n-dimensional integral (we use spherical coordinates and recall that the 



surface of the unit sphere in R n is 



r(f,6 2 ) 
r(f,o) 

Then, translating the variable z by a, one obtains for a < \/ ndo , 



(H3) 



^11 2 



^ 4? / d;?e "" Zr ( H4 ) 

r(f,o) 

where the first inequality holds because the integration domain contains the one of the definition of F(a), and the 
second is the application of Eq. IH3I with b = \Jndo — 1. Choosing a — J finally gives 



with 



c o = (i-4=) • 
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Let X be a random variable with a Poisson distribution of parameter A = ncodo and assume n to be even, then 

(f ,nd c 

T(p) 

which implies that 



P r[ X<n/2] = £ll^), (H8) 



2 

Chernoff bound applied to a Poisson distribution of parameter A gives 

(1 - <J) 1- 

which gives here 



Fl\Mr) <Pr[X<n/2]. (H9) 



PrLY < (1 - S)X] < [ ) , (H10) 



with 



<e-^, (mi) 



/3 = c . - 1 + 1 °f^ . (H12) 



Using the fact that 1 + log(2co) < 0, one obtains 



F\\l^)<e-* (H13) 



2 

with 

/3 = c d -^. (H14) 

□ 

2. Proof of the lemma 

One can use the same trick as in [|| and extend the Hilbert space Hi to Hi <8> H^ and write the operator 

T n as 

T„ = / w(0\U® n (|f)(f| s 8 |y)(y|g) U^ n \0) w dxdy (H15) 

where the subscripts S and S refer to the two possible choices of quadrature (either described by s or its complement 
s), U = e^j(a(S)a'' — a' <£> a') is the beamsplitter operator and \0)-h' is the vacuum state on the space ®™ = iH'i- 
The ± sign depends on the specific choice of s. A possible choice for S and S would beS = Q = (Qi,---, Q n ) and 
S = P = (Pi, - • • ,P n )- In this section, the blod font is used to describe vectors. We also denote \a — x + iy) the 
coherent state centered in (x,y) in phase space, and will use the equality (0\U\x) s\y) § = -^\ a )- 
Let R be the subset of 1R 2 ™ corresponding to the support of the integral above: 

R = | (x , ff) e R 2n : X ' Vi > nd ° | • (H16) 
For a string s G {x, y} n , we define the set 1Z S as 

K s = ((f,,1eE 2 ":f^>4). (H17) 
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Note in particular that the coordinates corresponding to S are unbounded in this set. We also introduce the operator 
S = Si © • • • © S n where Sj = Qi(Pi) if s; = Xi(yi). Noting s the complement of s, one has for all s: 



which means that 



where 



RcK s UK s 



(H18) 
(H19) 



A, 



wWU 9 " (l^ls © |y)(y|s) U^ n \0) w dxdy. (H20) 

'(x,y)GK s 

Here, we used the fact that the integral of \y)(y\s on W™ is equal to that of \y)(y\s- this is simply the n-mode 
generalization of the well-known identity J \q)(q\dq = J \p)(p\dp where |g) and \p) are eigenstates of the quadrature 
operators, Q and P, respectively. Since the previous relation holds for any string s, one has: 



T ™ - ^2 As + As 



Let us compute the value of the operator A s : 

x + y\ I x + y 



w 



1 



\/2 /\ y/2 



x — y\ I x — y 



V2 /\ V2 



\0)n>dxdy 



l/2 



,-\W-y\\ 2 /2 



x + y\ / x + y 



V2 



dxdy. 



i(x,y)en a 

Changing variables: Z\ = \2x, z 2 = (x + y)j v2 (that is, x = z\j \/2, y = —Z\j \/2 + \f2z2) gives 

1 



7T"/2 
1 

W 2 
1 

W 2 
1 

F(S) 



(z 1 ,z 2 )s.t. (x,y)£lZ s 



(z 1 ,z 2 )s.t. (f,j)eR s 



|Zl Z2 " \z2)(z2\ s dzidz 2 

I - C II 2 

|Zl ~ " 1^2) (22 Is dzidz 2 



(H21) 

(H22) 
(H23) 

(H24) 

(H25) 

(H26) 

(H27) 
(H28) 

We now show for all a > 0, F(S) < pH s H - a + F(a)t. To prove it, we need to establish that for any eigenvector |s) 
of the operator S, it holds that 

(31F(S)|S) < (^P i|s||2 ^ q2 |5) + (s\F(a)l\s). (H29) 

There are two possibilities, 

• either ||s|| 2 > a 2 , in which case Eg. IH29I reads F(||s||) < 1 + F(a), which clearly holds, 

• or ||s|| 2 < fl2 7 hi which case Eg. IH29I reads F(||s||) < F(a), which holds because F(x) is an increasing function 
for x > 0. 



2*1 I - > nd{) 



1 1 > iuU\ 



.-llzi-SII 



dz\ 



dz\ 



I Z2) (%2 Is d ^*2 



Finally, one obtains 



T n <— P z " {s) - a2,n + 2F(a)l. 



s£{x,y} r 



Choosing a = ^/nd /2 gives 

T„ < 2M/ n + 2F 
which concludes the proof of Lemma IF.2I 



ndo 



1 < 2(W n + e~P n l), 



(H30) 



(H31) 



